asyncrat | 28a95a1217828befa28689c543b68ea7e553c74cc8d5a842b229e1814fb6c9f8

Sharing

Copy URL Twitter E-mail

General

Target
28a95a1217828befa28689c543b68ea7e553c74cc8d5a842b229e1814fb6c9f8
Size 45KB
Sample260804-hexv5see66
SHA256 28a95a1217828befa28689c543b68ea7e553c74cc8d5a842b229e1814fb6c9f8
MD5 271ed55ac5bd7bfddcb76f93a5a9000f
SHA1 2713bc35327c342e4b1d71c9701cf147573a20e6
SHA512 10b6e6daafb7c515bd0cf3d216e66bf1148f8dc22ea76f3653fdd407bf8ee85c4783902674e1abfbdfb140acdfe9b9b5941f299f39f9e84f530f248d28a1201f
SSDEEP 768:wuDWZTpw7bmaWUg3gSk0mo2qldeeXKSocbbbQtN8/nPI6kzjbJgX3i14KZZVnhfy:wuDWZTpMZSB2FeH2tNKA6k3bGXS14Kl
TLSH
T140233B003BE9C22BF1BF4F7899F36105867AE2632603D95A1CC451DB4723FC68A526ED
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat default asyncrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

cwlottery.com:80
cwlottery.com:22
cwlottery.com:8080
cwlottery.com:8880
cwlottery.com:2052
cwlottery.com:2082
cwlottery.com:2086
cwlottery.com:2095
cwlottery.com:443
cwlottery.com:2053
cwlottery.com:2083
cwlottery.com:2087
cwlottery.com:2096
cwlottery.com:8443
www.cwlottery.com:80
www.cwlottery.com:22
www.cwlottery.com:8080
www.cwlottery.com:8880
www.cwlottery.com:2052
www.cwlottery.com:2082
www.cwlottery.com:2086
www.cwlottery.com:2095
www.cwlottery.com:443
www.cwlottery.com:2053
www.cwlottery.com:2083
www.cwlottery.com:2087
www.cwlottery.com:2096
www.cwlottery.com:8443
mirai.cwlottery.com:80
mirai.cwlottery.com:22
mirai.cwlottery.com:8080
mirai.cwlottery.com:8880
mirai.cwlottery.com:2052
mirai.cwlottery.com:2082
mirai.cwlottery.com:2086
mirai.cwlottery.com:2095
mirai.cwlottery.com:443
mirai.cwlottery.com:2053
mirai.cwlottery.com:2083
mirai.cwlottery.com:2087
mirai.cwlottery.com:2096
mirai.cwlottery.com:8443
socgholish.cwlottery.com:80
socgholish.cwlottery.com:22
socgholish.cwlottery.com:8080
socgholish.cwlottery.com:8880
socgholish.cwlottery.com:2052
socgholish.cwlottery.com:2082
socgholish.cwlottery.com:2086
socgholish.cwlottery.com:2095
socgholish.cwlottery.com:443
socgholish.cwlottery.com:2053
socgholish.cwlottery.com:2083
socgholish.cwlottery.com:2087
socgholish.cwlottery.com:2096
socgholish.cwlottery.com:8443

Mutex

RCh68pHbTS3f

Attributes

delay
0
install
true
install_file
wmuxx.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
sample	family_asyncrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
28a95a1217828befa28689c543b68ea7e553c74cc8d5a842b229e1814fb6c9f8

File Explorer

28a95a1217828befa28689c543b68ea7e553c74cc8d5a842b229e1814fb6c9f8

.exe 45KB

28a95a1217828befa28689c543b68ea7e553c74cc8d5a842b229e1814fb6c9f8

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 28a95a1217828befa28689c543b68ea7e553c74cc8d5a842b229e1814fb6c9f8
MD5 271ed55ac5bd7bfddcb76f93a5a9000f
SHA1 2713bc35327c342e4b1d71c9701cf147573a20e6
SHA512 10b6e6daafb7c515bd0cf3d216e66bf1148f8dc22ea76f3653fdd407bf8ee85c4783902674e1abfbdfb140acdfe9b9b5941f299f39f9e84f530f248d28a1201f
SSDEEP 768:wuDWZTpw7bmaWUg3gSk0mo2qldeeXKSocbbbQtN8/nPI6kzjbJgX3i14KZZVnhfy:wuDWZTpMZSB2FeH2tNKA6k3bGXS14Kl
TLSH
T140233B003BE9C22BF1BF4F7899F36105867AE2632603D95A1CC451DB4723FC68A526ED
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Async RAT payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

51262

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

28a95a1217828befa28689c543b68ea7e553c74cc8d5a842b229e1814fb6c9f8

mscoree

dotnet